https://www.yusufalmahmeed.com/tags/ssrf/Recent content in Ssrf on Yusuf AlMahmeedHugoen-us© 2026 Yusuf AlMahmeed · <a href="https://www.yusufalmahmeed.com/privacy/">privacy</a>Fri, 09 Oct 2026 18:09:00 +0300https://www.yusufalmahmeed.com/posts/portswigger/xxe/lab-xxe-to-ssrf/Fri, 09 Oct 2026 18:09:00 +0300https://www.yusufalmahmeed.com/posts/portswigger/xxe/lab-xxe-to-ssrf/<table> <thead> <tr> <th></th> <th></th> </tr> </thead> <tbody> <tr> <td><strong>Platform</strong></td> <td>PortSwigger Web Security Academy</td> </tr> <tr> <td><strong>Topic</strong></td> <td>XML external entity (XXE) injection</td> </tr> <tr> <td><strong>Lab</strong></td> <td>Exploiting XXE to perform SSRF attacks</td> </tr> <tr> <td><strong>Difficulty</strong></td> <td>Apprentice</td> </tr> <tr> <td><strong>Goal</strong></td> <td>Read the server&rsquo;s IAM credentials from cloud metadata</td> </tr> <tr> <td><strong>Tools</strong></td> <td>Burp Suite (Proxy + Repeater)</td> </tr> </tbody> </table> <h2 id="the-idea">The idea</h2> <p>In the <a href="https://www.yusufalmahmeed.com/posts/portswigger/xxe/lab-retrieve-files/">file-retrieval lab</a> the external entity pointed at a local file with <code>file://</code>. Point it at an <code>http://</code> URL instead and the XML parser becomes an HTTP client that fetches whatever URL we give it. That is <strong>SSRF</strong> (server-side request forgery): making the server send requests to targets we choose, from its own trusted position on the network.</p>